callable-lead-count-skill
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from HubSpot contacts which could potentially contain malicious instructions designed to influence the agent's behavior during the qualification or reporting stages.
- Ingestion points: External data is retrieved via
mcp__claude_ai_Epiphan_Ai__hubspot_search_contactsand theexecute_sqlfallback inSKILL.md(Stage 1). - Boundary markers: The instructions do not specify the use of delimiters (like XML tags or triple quotes) or 'ignore' instructions when passing contact properties to the
qualify_leadtool or generating the Markdown report. - Capability inventory: The skill has the capability to read PII from HubSpot, write to local state files (
history.jsonl,skill-runs,skill-analytics), and transmit data externally via Slack DMs. - Sanitization: There is no evidence of sanitization, filtering, or escaping of contact-supplied strings (e.g.,
firstname,lastname,jobtitle) before they are interpolated into the workflow. - [DATA_EXFILTRATION]: The skill extracts lead contact information (names, phones, emails) and sends it to external destinations.
- The data is delivered via Slack DM to a specific user and stored in local history files (
~/.claude/skill-state/history.jsonl). - While this aligns with the skill's primary purpose of lead reporting, the transmission of PII to external services (Slack) and local persistent logs constitutes a data exposure surface. Both HubSpot and Slack are recognized as well-known services, so these operations are documented as part of the intended workflow rather than malicious exfiltration.
Audit Metadata